Browse CVEs by Ecosystem and Severity
2,313 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
HIGH
CVE-2026-24058
Soft Serve Affected by an Authentication Bypass
HIGH
CVE-2026-0933
Wrangler affected by OS Command Injection in `wrangler pages deploy`
HIGH
CVE-2021-47853
phpPgAdmin contains a remote command execution vulnerability
HIGH
CVE-2026-23950EPSS 0.0%
Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS
HIGH
CVE-2026-23745EPSS 0.0%
node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization
HIGH
CVE-2026-23742
Skipper is vulnerable to arbitrary code execution through lua filters
HIGH
GHSA-5qw5-wf2q-f538
ActiveRecord-JDBC-Adapter (AR-JDBC) lib/arjdbc/jdbc/adapter.rb sql.gsub() Function SQL Injection
HIGH
CVE-2026-22864
Deno has an incomplete fix for command-injection prevention on Windows — case-insensitive extension bypass
HIGH
CVE-2026-23622
alextselegidis/easyappointments is Vulnerable to CSRF Protection Bypass
HIGH
CVE-2026-23527
h3 v1 has Request Smuggling (TE.TE) issue
HIGH
CVE-2026-23519
RustCrypto Utilities cmov: `thumbv6m-none-eabi` compiler emits non-constant time assembly when using `cmovnz`
HIGH
CVE-2026-23493
Pimcore ENV Variables and Cookie Informations are exposed in http_error_log
HIGH
CVE-2025-67647
SvelteKit is vulnerable to denial of service and possible SSRF when using prerendering
HIGH
CVE-2026-23492
Pimcore Has an Incomplete Patch for CVE-2023-30848
HIGH
CVE-2026-22812
OpenCode's Unauthenticated HTTP Server Allows Arbitrary Command Execution
HIGH
CVE-2026-22771
Envoy Extension Policy lua scripts injection causes arbitrary command execution
HIGH
CVE-2026-22700
RustCrypto Has Insufficient Length Validation in decrypt() in SM2-PKE
HIGH
CVE-2025-68493
Apache Struts 2 is Missing XML Validation
HIGH
CVE-2026-22699
SM2-PKE has Unchecked AffinePoint Decoding (unwrap) in decrypt()
HIGH
CVE-2026-22612
Fickling vulnerable to detection bypass due to "builtins" blindness
HIGH
CVE-2026-22698
SM2-PKE has 32-bit Biased Nonce Vulnerability
HIGH
CVE-2026-22609
Fickling has Static Analysis Bypass via Incomplete Dangerous Module Blocklist
HIGH
CVE-2026-22608
Fickling vulnerable to use of ctypes and pydoc gadget chain to bypass detection
HIGH
CVE-2026-22607
Fickling Blocklist Bypass: cProfile.run()
HIGH
CVE-2026-22606
Fickling has a bypass via runpy.run_path() and runpy.run_module()
HIGH
CVE-2026-22610
Angular has XSS Vulnerability via Unsanitized SVG Script Attributes
HIGH
CVE-2026-22589
Spree API has Unauthenticated IDOR - Guest Address
HIGH
CVE-2026-22256
Salvo is vulnerable to reflected XSS in the list_html function
HIGH
CVE-2026-22257
Salvo is vulnerable to stored XSS in the list_html function by uploading files with malicious names
HIGH
GHSA-96qw-h329-v5rg
Shakapacker has environment variable leak via EnvironmentPlugin that exposes secrets to client-side bundles
HIGH
CVE-2026-22244
OpenMetadata's Server-Side Template Injection (SSTI) in FreeMarker email templates leads to RCE
HIGH
CVE-2026-22028
Preact has JSON VNode Injection issue
HIGH
CVE-2025-69264
pnpm v10+ Bypass "Dependency lifecycle scripts execution disabled by default"
HIGH
CVE-2025-68705
RustFS Path Traversal Vulnerability
HIGH
CVE-2025-9611
Microsoft Playwright MCP Server vulnerable to DNS Rebinding Attack; Allows Attackers Access to All Server Tools
HIGH
CVE-2026-21857
Redaxo has Path Traversal in Backup Addon Leading to Arbitrary File Read
HIGH
CVE-2025-68456
Unauthenticated Craft CMS users can trigger a database backup
HIGH
CVE-2025-66518
Apache Kyuubi Server vulnerable to Path Traversal
HIGH
CVE-2026-21449
Bagisto is vulnerable to SSTI via name parameters provided by non-admin low-privilege users
HIGH
CVE-2026-21448
Bagisto has Normal & Blind SSTI from low-privilege user when ordering product
HIGH
CVE-2026-21446
Bagisto Missing Authentication on Installer API Endpoints
HIGH
CVE-2026-21445
Langflow Missing Authentication on Critical API Endpoints
HIGH
CVE-2025-69257
theshit vulnerable to unsafe loading of user-owned Python rules when running as root
HIGH
CVE-2025-69210
FacturaScripts is Vulnerable to Stored Cross-Site Scripting (XSS) via XML File Upload
HIGH
CVE-2025-71367
Picklescan is vulnerable to RCE via missing detection when calling built-in python _operator.attrgetter
HIGH
CVE-2025-71375
Picklescan is vulnerable to RCE via missing detection when calling built-in python _operator.methodcaller
HIGH
CVE-2025-71372
Picklescan is vulnerable to RCE via missing detection when calling numpy.f2py.crackfortran.getlincoef
HIGH
CVE-2025-71362
Picklescan missing detection when calling numpy.f2py.crackfortran.getlincoef
HIGH
CVE-2025-71320
Picklescan has Incomplete List of Disallowed Inputs
HIGH
CVE-2025-71323
Picklescan does not block ctypes